UBUNTU-CVE-2026-89874: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify() creates ancillary media links before adding asc->ascsubdeventry to sd->asclist. If ancillary link creation fails, the function jumps to errcallunbind while ascsubdeventry has not been linked yet. Async connections are zero-allocated, so the list entry still has NULL next and prev pointers on this path. Calling listdel() on it can therefore dereference NULL instead of returning the original link creation error. Do not delete ascsubdeventry from errcallunbind. There is no list insertion to undo on this path; the bound callback and sub-device registration are the operations that need to be rolled back.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Do not delete asc_subdev_entry from err_call_unbind when ancillary link creation fails, because asc_subdev_entry has not yet been linked; roll back the bound callback and sub-device registration instead.
Event History
Frequently Asked Questions
What conditions are required to trigger the failure?
Ancillary media-link creation must fail during v4l2_async_match_notify() before asc->asc_subdev_entry is added to sd->asc_list. The erroneous cleanup then calls list_del() on an unlinked, zero-initialized list entry whose next and prev pointers are NULL.
What is the practical impact of this bug?
Instead of returning the original ancillary-link creation error, the kernel can dereference NULL during error cleanup. This can cause a kernel fault on the affected error path.
Which Ubuntu kernel packages are identified as affected?
The provided data identifies ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What does the fix change?
The fix removes deletion of asc_subdev_entry from the err_call_unbind path, because that entry has not been inserted into a list at that point. Cleanup instead rolls back the bound callback and sub-device registration.